[security] audit repository tooling

open-telemetry / opamp-java

OpAMP protocol implementation in Java

Apache License 2.0

6 stars 6 forks source link

[security] audit repository tooling #9

Open sakshi-1505 opened 1 year ago

sakshi-1505 commented 1 year ago

The security SIG is looking to ensure that security tooling is setup consistently across the organization. As a result, we're asking maintainers to ensure the following tools are enabled in each repository:

[ ] CodeQL enabled via GitHub Actions
[ ] Static code analysis tool (the collector uses govulncheck [https://pkg.go.dev/golang.org/x/vuln] on every build)
[x] Repository security settings
- [x] Security Policy ✅
- [x] Security advisories ✅
- [ ] Private vulnerability reporting ✅
- [ ] Dependabot alerts ✅
- [ ] Code scanning alerts ✅

Parent issue: https://github.com/open-telemetry/sig-security/issues/12

sakshi-1505 commented 1 year ago

@jlegoff Can you please confirm if the above checks are enabled? I don't see any activity on this repository, I am not sure if it is even active or not. cc: @codeboten

jlegoff commented 1 year ago

@tigrannajaryan I think this repository can be archived. Last I remember, opamp was going to be implemented directly in the java sdk. What do you think?

tigrannajaryan commented 1 year ago

@jlegoff I agree, there is no activity in the repo. I will archive it.

Last I remember, opamp was going to be implemented directly in the java sdk.

I was not aware of this. Is this documented anywhere?

jlegoff commented 1 year ago

@tigrannajaryan this was discussed in the java instrumentation SIG (notes). That said, I'm not seeing any trace of opamp in the java repos. It seems like the decision wasn't made official and no concrete action was made after this discussion.